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1. Introduction 


As part of our ongoing effort to provide the best physical extraction capabilities for the latest Samsung 
Android devices, you can now obtain additional data by performing a physical extraction using the 
enhanced bootloader method that supports the latest firmware running Android 5.x on Samsung 
Android devices. 


This extraction method uses a blank memory card that is not related to the case and needs to 
be inserted into the source device. 


1.1. FAQ 


Why is a blank memory card required? 

A blank memory card is used in this method as part of the bypass process and it does not contain 
any user information. 

What is stored on the memory card? 


This method enforces the bypass of the device password, by "opening" the device via the memory 
card's interface. It does NOT store any user data or system data on the memory card. It only emulates 
a mass storage device in the system, and thereby bypasses the password and performs a physical 
extraction. 


What happens to the data on the device during the extraction? 


The device's system data or the user data files are not tampered with or corrupted during the 
extraction. This extraction method is forensically sound. 


Performing a physical extraction using the enhanced bootloader method: 


IL 
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Tap Mobile device in the home screen. 
Identify the device. The Select Extraction Type window appears: 


| Samsung GSM » SM-N900T Galaxy Note 3 » Select Extraction Type 


H > B Logical Extraction ® 
A 
a » n Disable User Lock © 


» = File System Extraction ® 


Physical Extraction 


H » AW Capture Screenshots 


Samsung GSM SM-N900T Galaxy Note 3 


3. Tap Physical Extraction. The following window appears: 


Samsung GSM » SM-N900T Galaxy Note 3 » Physical Extraction » Select Mode 


a 


Boot Loader 
(Recommended) 


4. Tap Boot Loader. The following window appears: 


Connect the source device to the USB port on the computer. If the device is already 
connected, disconnect and then reconnect the device. 


E Tutorial Video 


1. Before starting, the phone battery should be fully charged. 
2. Put the device in download mode How to? 
3. Connect the device to UFED How to? 


Note: 
If the battery is not sufficiently charged, use the power-up cable (if applicable). 


Samsung GSM SM-N900T Galaxy Note 3 
using cable A with yellow tip T-133 


5. Connect the source device to the USB port. If the device is already connected, disconnect and then 
reconnect the device. Follow the instructions to place the device in Download mode using cable A 


with the Yellow tip T-133. Examples are displayed next. 


NAME: Sé-NOBET 
BINARY: mm | Official 
oia 


10: Qi (8) 
QUALCOMM SECUREBOOT: ENABLE (CSB) 
AP SUREV: S2, T2, R2 AB, P2 


Downloading... 
Do not turn off target!! 
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The Cellebrite Extension Cable is recommended for UFED Touch, but is not required when 
using UFED 4PC. 


6. Inthe Waiting for Device window, tap Continue. The following window appears: 


Extraction in Progress 


Samsung GSM SM-N900T 
Galaxy Note 3 
using cable A with yellow 
tip T-133 


Extraction 
to PC using USB cable 
U441 


Reading Phone Info appears on the Extraction in Progress window for approximately 2 minutes. 


The following window appears: 
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ivering mobile expertise 


Initialization in progress. Perform the following steps to proceed. 


. Disconnect Cellebrite Extension cable and phone from the UFED. 
. Remove the BATTERY 
. Reinsert the BATTERY 
. Do NOT power on the phone 
. Connect cable-A with tip 133 to the phone 
. Connect the Cellebrite Extension Cable to Cable-A. 
Do NOT connect USB end of the Cellebrite Extension Cable to the UFED. 
. Wait until the download mode logo appears on the phone screen 
. Connect the USB end of the Cellebrite Extension Cable to the UFED. 
. Press Continue. 
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7. Follow the steps and tap Continue. 
"INVALID ODIN CMD" should be displayed on the device's screen. 


PRODUCT NAME: SM-N9GGT 

CURRENT BINARY: Samsung Official 
SYSTEM STATUS: Official 

KNOX WARRANTY VOID: Bx1 (0) 
QUALCOMM SECUREBOOT: ENABLE (CSB) 
RP SWREV: S2, T2, R2, A3, P2 


Downloading... 
$ Do not turn off target !! 


The following window appears: 


Extraction in Progress 


Samsung GSM SM-N900T 
Galaxy Note 3 
using cable A with yellow 


tip T-133 


Extraction 
to PC using USB cable 
U441 


Reading Phone Info appears on the Extraction in Progress window for approximately 5 seconds. The 
following window appears: 


Verify that there is no memory card inserted in the device. 


8. Verify that there isno memory card inserted in the device. 


To protect the user data on the memory card, ifyou do not remove the memory card the 
extraction will end. 
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9. Tap Continue. The following window appears: 


Insert a blank memory card that is not related to the case. 
WARNING: The memory card will be used for the extraction and its existing data will be overridden. 


This initialization process may take a while. Messages will be displayed on the device screen before 
extraction starts. 


10. Insert a blank memory card, which is not related to the case, into the device and tap Continue. The 
memory card will be used for the extraction and its existing data will be overridden. 


=) Ifa blank memory card is not inserted in the device, the extraction process will end and 
"Failed to Initialize SD card" will be displayed on the device. 


PRODUCT NAME: SM-N9BBT 
CURRENT BINARY: Sansung Official 
SYSTEM STATUS: Official 
VOID: @xi (8) 
M SECUREBOOT: ENABLE (CSB 
S2, T2, R2, AS, P2 


Failed to Initialize SD card 


Downloading... 


Do no 


Ifa blank memory card was inserted in the device the extraction continues. Reading Phone Info 
appears in the Extraction in Progress window for approximately 2 — 3 minutes. 


Extraction in Progress 


E 


Please Wait... 


Samsung GSM SM-N900T 
Galaxy Note 3 
using cable A with yellow 


tip T-133 


Extraction 
to PC using USB cable 
441 


During the extraction process, numerous "T-FLASH MODE" messages appear on the device's screen. 
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PRODUCT NAME: SM-N9B6T 

CURRENT BINARY: Samsung Official 
SYSTEM STATUS: Official 

KNOX WARRANTY VOID: Bx1 (8) 
QUALCOMM SECUREBOOT: ENABLE (CSB) 
HP SWREV: S2, T2, R2, A3, P2 


T-FLASH WODE 


alize SD card 


QED 


Downloading... 
I Do not turn off target!! 


The following window appears: 


Initialization in progress. Perform the following steps to proceed. 


1. Disconnect Cellebrite Extension cable and phone from the UFED. 
2. Remove the BATTERY 

3. Reinsert the BATTERY 

4. Do NOT power on the phone 

5. Connect cable-A with tip 133 to the phone 


6. Connect the Cellebrite Extension Cable to Cable-A. 

* Do NOT connect USB end of the Cellebrite Extension Cable to the UFED. 
7. Wait until the download mode logo appears on the phone screen 

8. Connect the USB end of the Cellebrite Extension Cable to the UFED. 


9. Press Continue. 


11. During the extraction process, Reading Phone Info appears on the Extraction in Progress window for 
approximately 2 minutes and numerous "T-FLASH MODE" messages appear on the device's screen. 


PRODUCT NAME: SM-NOBAT 

CURRENT BINARY: Samsung Official 
SYSTEM STATUS: Official 

KNOX WARRANTY VOID: Bx1 (8) 
QUALCOMM SECUREBOOT: ENABLE (CSB) 
RP SWREV: S2, T2, R2, A3, P2 


alize SD card 


(ae 


Downloading... 
Do not turn off target! 


Initializing is displayed on the Extraction in Progress window for approximately 20 minutes. 
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celebrite UFED TOUCH Mi Es ft o > > mæ 
Setran motie euporasa | None Keyboard Home Settings Tutorials Exit 


Extraction in Progress 


_ DE Initializing 
Samsung /-N900 


G 


using cable 


Extraction 
to PC using USB cable 
U441 


Numerous "T-FLASH MODE" messages appear on the device's screen. 


PRODUCT NAME: SH-NS@8T 

CURRENT BINARY: Samsung Official 
SYSTEM STATUS: Official 

KNOX WARRANTY VOID: @x1 (8) 
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Downloading... 
Do not turn off target !! 


The Reading File process starts, wait until the extraction completes. 


Extraction in Progress 


Reading File ==> 


File: 1 

Samsung GSM SM-N900T , 

Galaxy Note 3 Dumpbata bin 
using cable A with yellow 


tip T-133 


Extraction 
to PC using USB cable 
U441 


Time Remaining : 02:06:15 


